6.5
Moyenne
CVE-2026-16544 A flaw was found in AWX
Description
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2506053 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Ansible Automation Platform 2
Les 210 CVE de Red Hat Ansible Automation Platform 2 →
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Faible
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
5.4
Moyenne
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
Élevée
CVE-2026-89091
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
8.8
Élevée